GitHub Actions MCP Vulnerability: Stealing Private Repo Data via setup-gcloud Action

Key Information Summary Vulnerability Overview Vulnerability Name: GitHub MCP Exploited: Accessing private repositories via MCP Impact Scope: The MCP (Multi-Cloud Provider) service in GitHub Actions, which allows attackers to access private repository data. Discoverer: Security analysts from Invariant. Attack Scenario Prerequisites: - Use of GitHub Actions and Cloud Build with read access to the target repository. - Presence of the Action, used to download, install, and configure the gcloud CLI. - Presence of the Docker image with specific execution permissions and environment variables. Attack Process: - Attackers exploit the Action to download and execute malicious scripts. - The malicious script retrieves sensitive information from the target repository via the MCP service. Attack Demonstration User Information Leakage: - Attackers can obtain users’ private information, including but not limited to: - Username - Email address - Public key fingerprint - SSH key Example Attack Code: Detecting Malicious Agent Traffic Detection Method: - Use Invariant’s security analyzer to detect network traffic related to MCP. - Analyze anomalous patterns and behaviors in network traffic to identify potential attack activities. Scope and Mitigation Measures Scope: - This vulnerability is not limited to GitHub Actions and may affect other systems using similar implementations. Mitigation Measures: 1. Implement Strict Access Controls: - Enforce fine-grained permission checks for all MCP calls. - Prohibit unauthorized agents from accessing any protected resources. 2. Continuous Security Monitoring: - Implement continuous security monitoring to promptly detect and respond to potential threats. Conclusion Main Findings: - Through carefully crafted attacks, attackers can exploit the MCP service to access private repository data. - Attackers can obtain sensitive user information, including usernames, email addresses, public key fingerprints, and SSH keys. Recommendations: - It is strongly recommended that all organizations using GitHub Actions or similar systems implement necessary security measures to prevent such attacks.

Goal Reached Thanks to every supporter — we hit 100%!

GitHub Actions MCP Vulnerability: Stealing Private Repo Data via setup-gcloud Action